primitive-admin 1.1.0-alpha.9 → 1.1.0

package/dist/src/lib/workflow-apply.js

@@ -0,0 +1,164 @@
+/**
+ * Shared "apply a TOML body to an existing workflow" helper.
+ *
+ * Extracted from the `config push` update-existing path (#1249, Fork 4) so that
+ * both `config push` and `workflows update --from-file` push a revised body the
+ * same way. A second inlined copy would regress #807: the update is
+ * ordering-sensitive and a naive metadata-then-body sequence rejects valid
+ * sync-callable edits.
+ *
+ * Ordering invariant (#807 / codex review, revised by #2743). `syncCallable` is
+ * sequenced BY TARGET VALUE, because the two directions have opposite
+ * constraints:
+ *   1. metadata PATCH — carries `syncCallable: false` when the target is false
+ *      (the TOML omits the key or sets it to `false`), and NOTHING when the
+ *      target is true. Enabling here would be validated against the workflow's
+ *      CURRENTLY-active server steps (`loadCurrentActiveSteps`,
+ *      src/admin-api.ts), not the steps being pushed in the same call, so it
+ *      would be rejected on the stale list. Disabling has no such check — the
+ *      server re-validates steps only when flipping TO true — and it must
+ *      happen here, because the step-write endpoints
+ *      (`updateWorkflowDraft` / `updateWorkflowConfig`) reject
+ *      sync-incompatible steps while the STORED flag is still true. Clearing
+ *      the flag first is what lets a single push both drop `syncCallable` and
+ *      introduce an incompatible step.
+ *   2. body write — steps to the active config (config-model) or the legacy
+ *      draft slot (no active config).
+ *   3. a SECOND `syncCallable` PATCH, for ENABLING only — issued AFTER the new
+ *      steps are active, so it validates against the new (compatible) steps.
+ *      Skipped when the first PATCH's response already reports the flag on;
+ *      sent unconditionally when that response is unreadable (fail closed
+ *      toward convergence).
+ *
+ * #2743 also removed the "only send it when the TOML carries the key"
+ * no-clobber rule: the file fully describes the workflow, so deleting
+ * `syncCallable = true` from it disables the flag in one push.
+ */
+import { buildWorkflowPayloadFromToml, safeJsonParse } from "./workflow-payload.js";
+// #1177: `safeJsonParse` now lives in the shared `workflow-payload` lib module
+// (the builder needs it too); re-exported here so existing importers of this
+// module keep working. Both `cli/src/lib` modules; no dep-direction problem.
+export { safeJsonParse };
+/** The slot label a body gets when the workflow has no active config. */
+export const LEGACY_DRAFT_SLOT_LABEL = "draft (legacy)";
+/**
+ * The warning a push owes the user when its body landed in the legacy draft
+ * slot and is NOT what the workflow runs (#2768).
+ *
+ * `workflows publish`, the one thing that promoted that slot, is gone, so those
+ * steps sit there unread — a silent no-op otherwise, since the push reports
+ * success either way.
+ *
+ * Reading a workflow is not neutral, which is why this takes more than an
+ * active config id. `getAppWorkflow` (src/admin-api.ts) auto-migrates a
+ * workflow that has NO configurations: it copies the latest revision — or, only
+ * when there is none, the draft slot — into a configuration and activates it.
+ * `applyWorkflowBody` reads the workflow immediately after writing the draft,
+ * so a legacy workflow WITH a published revision comes back carrying a
+ * brand-new `activeConfigId` holding the OLD body. Keyed on that id alone, the
+ * warning stayed silent for exactly the population it exists for. So:
+ *
+ * - the push activated a configuration itself (sidecar + `activeConfigName`):
+ *   silent — that push IS the migration;
+ * - an active configuration and no revision behind it: silent — the server
+ *   adopted the draft this push just wrote, and it is live;
+ * - an active configuration with a revision behind it: warn — that revision is
+ *   what runs, not the pushed steps;
+ * - no active configuration at all: warn, and name the TOML migration.
+ *
+ * Exported for testability — the end-to-end path needs a workflow that can no
+ * longer be created through the API.
+ */
+export function legacyDraftSlotWarning(updateSlotLabel, state) {
+    if (updateSlotLabel !== LEGACY_DRAFT_SLOT_LABEL)
+        return null;
+    const { activeConfigId, activatedByPush, latestRevision } = state;
+    if (activatedByPush)
+        return null;
+    if (activeConfigId && !latestRevision)
+        return null;
+    const retired = "nothing promotes that slot any more ('workflows publish' was removed in #2768)";
+    if (activeConfigId) {
+        return (`Steps landed in the legacy draft slot, and ${retired}. Reading the workflow ` +
+            "migrated it onto the configurations model from its LATEST REVISION, so what " +
+            "runs is that revision, not the steps just pushed.\n" +
+            "Push again ('primitive config push --force') to write them to the active " +
+            "configuration, after checking that the file's body is the one you want live.");
+    }
+    return ("Steps landed in the legacy draft slot: this workflow has no active configuration, " +
+        `and ${retired}, so the pushed body will not run.\n` +
+        "Migrate it in TOML: put the body in workflows/<key>.configs/<name>.toml, set " +
+        'activeConfigName = "<name>" in workflows/<key>.toml, and push again.');
+}
+/**
+ * Apply a parsed workflow body (metadata + steps) to an existing workflow,
+ * preserving the key/id. `workflow` is the TOML's `[workflow]` table (already
+ * merged with any explicit CLI flag overrides by the caller); `steps` is the
+ * TOML's `steps` array. The function performs the three-step ordered update
+ * and returns the latest `modifiedAt`, the slot label, and a fresh workflow.
+ */
+export async function applyWorkflowBody(client, appId, workflowId, workflow, steps, opts = {}) {
+    const { expectedModifiedAt, activeConfigId, force } = opts;
+    // #2743 — the target `syncCallable` state the file declares. Only an explicit
+    // `true` enables (mirroring the server's opt-in handler), so a TOML that
+    // omits the key targets `false` and converges a server that has it on.
+    const targetSyncCallable = workflow.syncCallable === true;
+    // 1. Metadata PATCH — always-send (#2743): the builder (`mode: "update"`)
+    //    emits every `[workflow]` field with a definite value, so a line deleted
+    //    from the file clears or resets it server-side instead of being silently
+    //    preserved. `syncCallable` is the one field the builder leaves out,
+    //    because its position in the sequence depends on the target value: a
+    //    disable rides along here (before the steps write), an enable waits for
+    //    step 3. The `metadataManifest` declared-access manifest (#1304) is
+    //    call-site-specific and attached below, not owned by the shared builder.
+    const updated = await client.updateWorkflow(appId, workflowId, {
+        ...buildWorkflowPayloadFromToml(workflow, { mode: "update" }),
+        ...(targetSyncCallable ? {} : { syncCallable: false }),
+        // #1304 (P-C): declared-access manifest. Absent key → undefined (server's
+        // hasOwnProperty guard leaves it untouched); a parsed value/null is
+        // forwarded so a pull → push round-trips it (null clears). `config push`
+        // always attaches this (null when the TOML drops `[metadata]`); the
+        // `workflows update --from-file` caller may leave it undefined.
+        metadataManifest: workflow.metadataManifest !== undefined ? workflow.metadataManifest : undefined,
+    }, expectedModifiedAt);
+    // The first PATCH bumps `modifiedAt`; the syncCallable PATCH (if any) bumps
+    // it again. The config/step update does NOT touch the workflow definition's
+    // `modifiedAt`.
+    let latestModifiedAt = updated?.workflow?.modifiedAt;
+    // 2. Body write — active config (config-model) or legacy draft slot. #1614 —
+    //    the named `expr.*` definitions live on the same R2 steps payload as the
+    //    steps, so they travel with the steps write here (not the metadata PATCH
+    //    above). Attached by the caller onto `workflow.expressions` (structural,
+    //    like `metadataManifest`); absent → undefined so a workflow without
+    //    definitions round-trips a clean drop.
+    const expressions = workflow.expressions ?? undefined;
+    let updateSlotLabel = "active config";
+    if (activeConfigId) {
+        await client.updateWorkflowConfig(appId, workflowId, activeConfigId, {
+            steps,
+            expressions,
+        });
+    }
+    else {
+        await client.updateWorkflowDraft(appId, workflowId, {
+            steps,
+            expressions,
+            inputSchema: workflow.inputSchema ? safeJsonParse(workflow.inputSchema) : null,
+        });
+        updateSlotLabel = LEGACY_DRAFT_SLOT_LABEL;
+    }
+    // 3. Deferred `syncCallable` PATCH — ENABLING only, now that the new steps
+    //    are active (#807). Disabling already landed in step 1. Skipped when the
+    //    first PATCH's response reports the flag already on (nothing to converge,
+    //    and the call would cost a `modifiedAt` bump for no change); sent when
+    //    the response shape is unreadable, because "unreadable" is not evidence.
+    if (targetSyncCallable && updated?.workflow?.syncCallable !== true) {
+        const syncCallableUpdated = await client.updateWorkflow(appId, workflowId, { syncCallable: true }, force ? undefined : latestModifiedAt);
+        if (syncCallableUpdated?.workflow?.modifiedAt) {
+            latestModifiedAt = syncCallableUpdated.workflow.modifiedAt;
+        }
+    }
+    const fullWorkflow = await client.getWorkflow(appId, workflowId);
+    return { latestModifiedAt, updateSlotLabel, fullWorkflow };
+}
+//# sourceMappingURL=workflow-apply.js.map

package/dist/src/lib/workflow-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-apply.js","sourceRoot":"","sources":["../../../src/lib/workflow-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEpF,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,OAAO,EAAE,aAAa,EAAE,CAAC;AAezB,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAexD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAuB,EACvB,KAA2B;IAE3B,IAAI,eAAe,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAClE,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,cAAc,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,OAAO,GACX,gFAAgF,CAAC;IACnF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CACL,8CAA8C,OAAO,yBAAyB;YAC9E,8EAA8E;YAC9E,qDAAqD;YACrD,2EAA2E;YAC3E,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,CACL,oFAAoF;QACpF,OAAO,OAAO,sCAAsC;QACpD,+EAA+E;QAC/E,sEAAsE,CACvE,CAAC;AACJ,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,KAAa,EACb,UAAkB,EAClB,QAAa,EACb,KAAY,EACZ,OAAiC,EAAE;IAEnC,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAE3D,8EAA8E;IAC9E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,kBAAkB,GAAG,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC;IAE1D,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CACzC,KAAK,EACL,UAAU,EACV;QACE,GAAG,4BAA4B,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7D,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACtD,0EAA0E;QAC1E,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,gEAAgE;QAChE,gBAAgB,EACd,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;KAClF,EACD,kBAAkB,CACnB,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,gBAAgB;IAChB,IAAI,gBAAgB,GAAuB,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC;IAEzE,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,WAAW,GAAI,QAAgB,CAAC,WAAW,IAAI,SAAS,CAAC;IAC/D,IAAI,eAAe,GAAG,eAAe,CAAC;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE;YACnE,KAAK;YACL,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE;YAClD,KAAK;YACL,WAAW;YACX,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;SAC/E,CAAC,CAAC;QACH,eAAe,GAAG,uBAAuB,CAAC;IAC5C,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,kBAAkB,IAAI,OAAO,EAAE,QAAQ,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC;QACnE,MAAM,mBAAmB,GAAG,MAAM,MAAM,CAAC,cAAc,CACrD,KAAK,EACL,UAAU,EACV,EAAE,YAAY,EAAE,IAAI,EAAE,EACtB,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CACrC,CAAC;QACF,IAAI,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC9C,gBAAgB,GAAG,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC"}

package/dist/src/lib/workflow-codegen/generated-schema-descriptor.d.ts

@@ -0,0 +1,129 @@
+/**
+ * GENERATED FILE — DO NOT EDIT BY HAND.
+ *
+ * Vendored byte-for-byte from the canonical server module
+ * `src/workflows/schema-descriptor.ts` — the SAME interpretation the server
+ * validator (`validateValue`) enforces. The CLI cannot import server `src/`
+ * at runtime, so `workflows codegen`'s type converter imports this committed
+ * copy instead.
+ *
+ * Regenerate with:
+ *   node cli/scripts/gen-workflow-schema-descriptor.mjs   (runs at CLI prebuild)
+ *
+ * A CI freshness guard
+ * (`cli/scripts/gen-workflow-schema-descriptor.mjs --check`, also asserted by
+ * `cli/tests/unit/workflow-codegen-descriptor-drift-guard.test.ts`) fails if
+ * this committed copy does not match the source — see issue #1442 / #998.
+ */
+/**
+ * Canonical interpretation of the JSON-Schema subset the workflow platform
+ * supports (issue #1442).
+ *
+ * The server validator (`validateValue` in `schema-validation.ts`) and the CLI
+ * `workflows codegen` type converter (`workflow-codegen/schemaToTs.ts`) must
+ * agree EXACTLY on how a workflow `inputSchema`/`outputSchema` is interpreted —
+ * otherwise a generated `<Key>Input` type promises a shape the runtime does not
+ * enforce (or rejects a value the runtime accepts). Previously the converter
+ * re-derived those interpretation decisions by hand, which drifts from the
+ * validator over time.
+ *
+ * This module is the single source of that interpretation. Both consumers read
+ * from `describeSchema` + `isType`:
+ *
+ *   - the type gate is checked before `enum` (a value failing `type` is
+ *     rejected before `enum` is consulted);
+ *   - a type UNION (`type: ["string","null"]`) never descends into
+ *     `properties`/`items` — only the exact string types `"object"`/`"array"`
+ *     do;
+ *   - `integer` means `Number.isInteger`;
+ *   - `additionalProperties` only closes an object; it is not a nested schema.
+ *
+ * It is deliberately dependency-free (no imports) so the CLI can vendor a
+ * byte-for-byte copy as a committed artifact via
+ * `cli/scripts/gen-workflow-schema-descriptor.mjs` (the #998 gen-allowlist
+ * pattern). A drift-guard test runs that generator in `--check` mode, so a
+ * change here that isn't regenerated into the CLI artifact fails CI. The CLI
+ * never imports server `src/` at runtime — only the build-time generator reads
+ * this file.
+ */
+/** Does a value satisfy a JSON-schema `type` name? `integer` = `Number.isInteger`. */
+export declare function isType(value: any, type: string): boolean;
+/**
+ * The interpretation of a single schema node, normalized so both the validator
+ * and the type converter can consume it without re-reading raw schema fields.
+ */
+export interface SchemaDescriptor {
+    /** True when `schema.type` is an array (a type union). */
+    isUnion: boolean;
+    /** `schema.type` when it is a single string; null for a union or absent type. */
+    singularType: string | null;
+    /**
+     * The declared type(s) normalized to an array. An array `type` is kept as-is;
+     * a single string becomes a one-element array; an absent/falsy type is `[]`
+     * (no type gate). Matches the validator's `allowedTypes` normalization.
+     */
+    types: string[];
+    /** The `enum` array when present, else null. */
+    enumValues: any[] | null;
+    /**
+     * Object descent info — non-null ONLY when `schema.type` is exactly the
+     * string `"object"` AND `properties` is a declared object (matching the
+     * validator's `schema.type === "object" && schema.properties` descent gate).
+     * A type UNION containing `"object"` never descends.
+     */
+    object: {
+        /** The raw `properties` map (child schemas). May be empty `{}`. */
+        properties: Record<string, any>;
+        /** The raw `required` list (unfiltered, as the validator reads it). */
+        required: any[];
+        /** True when `additionalProperties === false` (a closed object). */
+        additionalPropertiesClosed: boolean;
+    } | null;
+    /**
+     * Array descent info — non-null ONLY when `schema.type` is exactly the string
+     * `"array"` AND `items` is present (matching the validator's
+     * `schema.type === "array" && schema.items` descent gate).
+     */
+    array: {
+        /** The raw `items` schema (may be a tuple array the validator no-ops on). */
+        items: any;
+    } | null;
+    /**
+     * Discriminated-union (tagged-union) interpretation of a `oneOf` node (#1511).
+     *
+     * Populated ONLY when the node carries a `oneOf` (or `anyOf`) array whose
+     * members are ALL `type: "object"` — a clearly-intended tagged union. A
+     * `oneOf`/`anyOf` with any non-object member is NOT a tagged union: `oneOf`
+     * stays `null` here and is ignored (renders `unknown` / validates
+     * permissively) exactly as before, preserving backward compatibility.
+     *
+     *   - `kind: "valid"` — a clean discriminated union: ≥2 object members sharing
+     *     exactly one discriminator property declared as a single-literal `enum`
+     *     in every member with distinct literals across members. The validator
+     *     branch-selects by `discriminant` and validates only the matched member;
+     *     the type converter renders the `|`-union of member object types.
+     *   - `kind: "invalid"` — an all-object-member union that LOOKS like a tagged
+     *     union but is defective (fewer than 2 members, no/ambiguous discriminator,
+     *     or `anyOf` — unsupported in v1). `reason` is the codegen error message.
+     *     The runtime validator ignores this (stays permissive); the codegen
+     *     converter throws `reason` (Fork 3 = strict, resolved by the maintainer).
+     */
+    oneOf: {
+        kind: "valid";
+        /** The auto-detected discriminator property name. */
+        discriminant: string;
+        /** One entry per member: its discriminant literal + raw member schema. */
+        members: Array<{
+            discriminantValue: any;
+            schema: any;
+        }>;
+    } | {
+        kind: "invalid";
+        reason: string;
+    } | null;
+}
+/**
+ * Interpret a parsed schema node. A non-object schema (null, array, scalar)
+ * enforces nothing → the empty descriptor.
+ */
+export declare function describeSchema(schema: any): SchemaDescriptor;

package/dist/src/lib/workflow-codegen/generated-schema-descriptor.js

@@ -0,0 +1,269 @@
+/**
+ * GENERATED FILE — DO NOT EDIT BY HAND.
+ *
+ * Vendored byte-for-byte from the canonical server module
+ * `src/workflows/schema-descriptor.ts` — the SAME interpretation the server
+ * validator (`validateValue`) enforces. The CLI cannot import server `src/`
+ * at runtime, so `workflows codegen`'s type converter imports this committed
+ * copy instead.
+ *
+ * Regenerate with:
+ *   node cli/scripts/gen-workflow-schema-descriptor.mjs   (runs at CLI prebuild)
+ *
+ * A CI freshness guard
+ * (`cli/scripts/gen-workflow-schema-descriptor.mjs --check`, also asserted by
+ * `cli/tests/unit/workflow-codegen-descriptor-drift-guard.test.ts`) fails if
+ * this committed copy does not match the source — see issue #1442 / #998.
+ */
+/**
+ * Canonical interpretation of the JSON-Schema subset the workflow platform
+ * supports (issue #1442).
+ *
+ * The server validator (`validateValue` in `schema-validation.ts`) and the CLI
+ * `workflows codegen` type converter (`workflow-codegen/schemaToTs.ts`) must
+ * agree EXACTLY on how a workflow `inputSchema`/`outputSchema` is interpreted —
+ * otherwise a generated `<Key>Input` type promises a shape the runtime does not
+ * enforce (or rejects a value the runtime accepts). Previously the converter
+ * re-derived those interpretation decisions by hand, which drifts from the
+ * validator over time.
+ *
+ * This module is the single source of that interpretation. Both consumers read
+ * from `describeSchema` + `isType`:
+ *
+ *   - the type gate is checked before `enum` (a value failing `type` is
+ *     rejected before `enum` is consulted);
+ *   - a type UNION (`type: ["string","null"]`) never descends into
+ *     `properties`/`items` — only the exact string types `"object"`/`"array"`
+ *     do;
+ *   - `integer` means `Number.isInteger`;
+ *   - `additionalProperties` only closes an object; it is not a nested schema.
+ *
+ * It is deliberately dependency-free (no imports) so the CLI can vendor a
+ * byte-for-byte copy as a committed artifact via
+ * `cli/scripts/gen-workflow-schema-descriptor.mjs` (the #998 gen-allowlist
+ * pattern). A drift-guard test runs that generator in `--check` mode, so a
+ * change here that isn't regenerated into the CLI artifact fails CI. The CLI
+ * never imports server `src/` at runtime — only the build-time generator reads
+ * this file.
+ */
+/** Does a value satisfy a JSON-schema `type` name? `integer` = `Number.isInteger`. */
+export function isType(value, type) {
+    if (type === "array")
+        return Array.isArray(value);
+    if (type === "object")
+        return !!value && typeof value === "object" && !Array.isArray(value);
+    if (type === "string")
+        return typeof value === "string";
+    if (type === "number")
+        return typeof value === "number" && !Number.isNaN(value);
+    if (type === "integer")
+        return Number.isInteger(value);
+    if (type === "boolean")
+        return typeof value === "boolean";
+    if (type === "null")
+        return value === null;
+    // Unknown type name: nothing to enforce, so treat as a match (the validator
+    // must not reject a value against a keyword it does not model).
+    return true;
+}
+const EMPTY_DESCRIPTOR = {
+    isUnion: false,
+    singularType: null,
+    types: [],
+    enumValues: null,
+    object: null,
+    array: null,
+    oneOf: null,
+};
+/**
+ * Sibling constraint keywords that make a `oneOf` node a MIXED schema rather
+ * than a clean tagged union (#1511). A clean discriminated union carries only
+ * the `oneOf` keyword (plus annotations like `description`/`title`); it never
+ * combines with a top-level `type`/`properties`/`required`/`additionalProperties`/
+ * `items`/`enum`. When any of these co-occur with `oneOf`, the validator's
+ * branch-select would early-return and skip those sibling constraints, silently
+ * loosening validation. So a mixed node is NOT treated as a clean tagged union.
+ */
+const ONEOF_SIBLING_CONSTRAINT_KEYS = [
+    "type",
+    "properties",
+    "required",
+    "additionalProperties",
+    "items",
+    "enum",
+];
+function hasOneOfSiblingConstraints(schema) {
+    return ONEOF_SIBLING_CONSTRAINT_KEYS.some((k) => Object.prototype.hasOwnProperty.call(schema, k));
+}
+/**
+ * A discriminator tag must be a comparable scalar (string/number/boolean) so
+ * the validator's strict-`===` branch-select can match it against a JSON-parsed
+ * value (#1511). An object/array literal is structurally identical after a JSON
+ * round-trip but never the same reference, so it would always "match no case".
+ * Restricting the auto-detected discriminator to scalars keeps a non-scalar tag
+ * from being treated as a (never-matchable) discriminator.
+ */
+function isScalarDiscriminatorLiteral(value) {
+    return (typeof value === "string" ||
+        typeof value === "number" ||
+        typeof value === "boolean");
+}
+/**
+ * Interpret a `oneOf`/`anyOf` node as a discriminated (tagged) union (#1511).
+ *
+ * The tagged-union interpretation is scoped to a clearly-intended tagged union:
+ * EVERY member must be `type: "object"`. Anything else (a mixed/scalar `oneOf`)
+ * returns `null` and is ignored downstream, exactly as before.
+ *
+ * Within that scope:
+ *   - `anyOf` is not supported in v1 → `invalid` (codegen error suggests `oneOf`);
+ *   - a `oneOf` with fewer than 2 members → `invalid`;
+ *   - the discriminator is auto-detected: the single property present in EVERY
+ *     member as a single-literal `enum` whose literal is a comparable scalar
+ *     (string/number/boolean), with distinct literals across members (a
+ *     non-scalar literal is not a candidate — see `isScalarDiscriminatorLiteral`);
+ *   - zero or more-than-one candidate discriminator → `invalid` (ambiguity).
+ *
+ * Pure and dependency-free so the CLI can vendor a byte-for-byte copy.
+ */
+function describeOneOf(schema) {
+    const rawOneOf = Array.isArray(schema.oneOf) ? schema.oneOf : null;
+    const rawAnyOf = Array.isArray(schema.anyOf) ? schema.anyOf : null;
+    // `oneOf` takes precedence; only one keyword is interpreted per node.
+    const keyword = rawOneOf
+        ? "oneOf"
+        : rawAnyOf
+            ? "anyOf"
+            : null;
+    const members = rawOneOf ?? rawAnyOf;
+    if (!keyword || !members)
+        return null;
+    // Scope to a clearly-intended tagged union: every member is `type: "object"`.
+    // A member that is not a plain object type means this is NOT a tagged union;
+    // leave it to the existing ignore-and-render-`unknown` path (backward compat).
+    const allObjects = members.length >= 1 &&
+        members.every((m) => !!m &&
+            typeof m === "object" &&
+            !Array.isArray(m) &&
+            m.type === "object");
+    if (!allObjects)
+        return null;
+    // `anyOf` is not supported in v1 (resolved Fork 1 = oneOf only). An all-object
+    // `anyOf` that looks like a tagged union gets a clear error suggesting oneOf.
+    if (keyword === "anyOf") {
+        return {
+            kind: "invalid",
+            reason: "anyOf is not supported for discriminated unions (issue #1511). Use oneOf instead.",
+        };
+    }
+    if (members.length < 2) {
+        return {
+            kind: "invalid",
+            reason: "A discriminated-union oneOf needs at least 2 object members (issue #1511).",
+        };
+    }
+    // For each member, collect its single-literal-enum properties → { name: literal }.
+    // The literal must be a comparable scalar (string/number/boolean): the
+    // validator branch-selects with strict `===`, so a non-scalar tag (object or
+    // array) on a JSON-parsed value is never the same reference as the schema
+    // literal and would always "match no case". Restricting the auto-detected
+    // discriminator to scalars means a non-scalar tag is not a candidate, so the
+    // union routes through the normal not-a-tagged-union path (below) instead of
+    // being accepted as a union that can never validate.
+    const memberLiteralProps = members.map((m) => {
+        const map = new Map();
+        const props = m.properties;
+        if (props && typeof props === "object" && !Array.isArray(props)) {
+            for (const [name, sub] of Object.entries(props)) {
+                if (sub &&
+                    typeof sub === "object" &&
+                    Array.isArray(sub.enum) &&
+                    sub.enum.length === 1 &&
+                    isScalarDiscriminatorLiteral(sub.enum[0])) {
+                    map.set(name, sub.enum[0]);
+                }
+            }
+        }
+        return map;
+    });
+    // A candidate discriminator is present as a single-literal enum in EVERY
+    // member, with distinct literals across members (so a value's tag selects
+    // exactly one branch).
+    const candidates = [];
+    for (const name of memberLiteralProps[0].keys()) {
+        if (!memberLiteralProps.every((mp) => mp.has(name)))
+            continue;
+        const literals = memberLiteralProps.map((mp) => mp.get(name));
+        const distinct = new Set(literals.map((l) => JSON.stringify(l)));
+        if (distinct.size === literals.length)
+            candidates.push(name);
+    }
+    if (candidates.length !== 1) {
+        return {
+            kind: "invalid",
+            reason: candidates.length === 0
+                ? "No discriminator found for the oneOf tagged union (issue #1511): every member must share exactly one property declared as a distinct single-literal enum."
+                : `Ambiguous discriminator for the oneOf tagged union (issue #1511): multiple candidate properties (${candidates.join(", ")}). Exactly one is required.`,
+        };
+    }
+    // A clean tagged union carries ONLY `oneOf`. If it co-occurs with sibling
+    // top-level constraints (`type`, `properties`, `required`,
+    // `additionalProperties`, `items`, `enum`), it is a MIXED schema, not a clean
+    // tagged union: the validator's branch-select would early-return and skip
+    // those siblings, loosening validation. Reject-mixed keeps all three
+    // consumers fail-closed — the validator falls through to the normal
+    // type/object gates (still enforcing the siblings, exactly as before #1511),
+    // codegen throws this `reason`, and the request guard flags `unsupported-oneof`.
+    if (hasOneOfSiblingConstraints(schema)) {
+        return {
+            kind: "invalid",
+            reason: "A discriminated-union oneOf must be the only top-level constraint (issue #1511): it cannot be combined with sibling type/properties/required/additionalProperties/items/enum. Move the shared constraints into each member instead.",
+        };
+    }
+    const discriminant = candidates[0];
+    return {
+        kind: "valid",
+        discriminant,
+        members: members.map((m, i) => ({
+            discriminantValue: memberLiteralProps[i].get(discriminant),
+            schema: m,
+        })),
+    };
+}
+/**
+ * Interpret a parsed schema node. A non-object schema (null, array, scalar)
+ * enforces nothing → the empty descriptor.
+ */
+export function describeSchema(schema) {
+    if (!schema || typeof schema !== "object" || Array.isArray(schema)) {
+        return EMPTY_DESCRIPTOR;
+    }
+    const typeSpec = schema.type;
+    const isUnion = Array.isArray(typeSpec);
+    const singularType = typeof typeSpec === "string" ? typeSpec : null;
+    // Mirror the validator's normalization exactly: an array stays an array; a
+    // truthy non-array becomes `[typeSpec]`; anything falsy is `[]`.
+    const types = isUnion ? typeSpec : typeSpec ? [typeSpec] : [];
+    const enumValues = Array.isArray(schema.enum)
+        ? schema.enum
+        : null;
+    const props = schema.properties;
+    const object = singularType === "object" &&
+        props &&
+        typeof props === "object" &&
+        !Array.isArray(props)
+        ? {
+            properties: props,
+            required: Array.isArray(schema.required)
+                ? schema.required
+                : [],
+            additionalPropertiesClosed: schema.additionalProperties === false,
+        }
+        : null;
+    const array = singularType === "array" && schema.items
+        ? { items: schema.items }
+        : null;
+    const oneOf = describeOneOf(schema);
+    return { isUnion, singularType, types, enumValues, object, array, oneOf };
+}
+//# sourceMappingURL=generated-schema-descriptor.js.map

package/dist/src/lib/workflow-codegen/generated-schema-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-schema-descriptor.js","sourceRoot":"","sources":["../../../../src/lib/workflow-codegen/generated-schema-descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,sFAAsF;AACtF,MAAM,UAAU,MAAM,CAAC,KAAU,EAAE,IAAY;IAC7C,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,QAAQ;QACnB,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;IACxD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC;IAC1D,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,KAAK,IAAI,CAAC;IAC3C,4EAA4E;IAC5E,gEAAgE;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AA0ED,MAAM,gBAAgB,GAAqB;IACzC,OAAO,EAAE,KAAK;IACd,YAAY,EAAE,IAAI;IAClB,KAAK,EAAE,EAAE;IACT,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE,IAAI;IACZ,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,IAAI;CACZ,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,6BAA6B,GAAG;IACpC,MAAM;IACN,YAAY;IACZ,UAAU;IACV,sBAAsB;IACtB,OAAO;IACP,MAAM;CACE,CAAC;AAEX,SAAS,0BAA0B,CAAC,MAA2B;IAC7D,OAAO,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9C,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,4BAA4B,CAAC,KAAc;IAClD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,aAAa,CAAC,MAA2B;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,sEAAsE;IACtE,MAAM,OAAO,GAA6B,QAAQ;QAChD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,QAAQ;YACR,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC;IACrC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAEtC,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,UAAU,GACd,OAAO,CAAC,MAAM,IAAI,CAAC;QACnB,OAAO,CAAC,KAAK,CACX,CAAC,CAAM,EAAE,EAAE,CACT,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,QAAQ;YACrB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,KAAK,QAAQ,CACtB,CAAC;IACJ,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,+EAA+E;IAC/E,8EAA8E;IAC9E,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EACJ,mFAAmF;SACtF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EACJ,4EAA4E;SAC/E,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,uEAAuE;IACvE,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,qDAAqD;IACrD,MAAM,kBAAkB,GAA4B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;QACzE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAe,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC;QAC3B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChD,IACE,GAAG;oBACH,OAAO,GAAG,KAAK,QAAQ;oBACvB,KAAK,CAAC,OAAO,CAAE,GAAW,CAAC,IAAI,CAAC;oBAC/B,GAAW,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;oBAC9B,4BAA4B,CAAE,GAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAClD,CAAC;oBACD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAG,GAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAC9D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EACJ,UAAU,CAAC,MAAM,KAAK,CAAC;gBACrB,CAAC,CAAC,2JAA2J;gBAC7J,CAAC,CAAC,oGAAoG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B;SAC7J,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,2DAA2D;IAC3D,8EAA8E;IAC9E,0EAA0E;IAC1E,qEAAqE;IACrE,oEAAoE;IACpE,6EAA6E;IAC7E,iFAAiF;IACjF,IAAI,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EACJ,qOAAqO;SACxO,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC;YAC3C,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YAC1D,MAAM,EAAE,CAAC;SACV,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAW;IACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAI,MAAc,CAAC,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,KAAK,GAAU,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,IAAI,CAAC;QACpD,CAAC,CAAE,MAAc,CAAC,IAAI;QACtB,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,KAAK,GAAI,MAAc,CAAC,UAAU,CAAC;IACzC,MAAM,MAAM,GACV,YAAY,KAAK,QAAQ;QACzB,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC;YACE,UAAU,EAAE,KAA4B;YACxC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,QAAQ,CAAC;gBAC/C,CAAC,CAAE,MAAc,CAAC,QAAQ;gBAC1B,CAAC,CAAC,EAAE;YACN,0BAA0B,EACvB,MAAc,CAAC,oBAAoB,KAAK,KAAK;SACjD;QACH,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,KAAK,GACT,YAAY,KAAK,OAAO,IAAK,MAAc,CAAC,KAAK;QAC/C,CAAC,CAAC,EAAE,KAAK,EAAG,MAAc,CAAC,KAAK,EAAE;QAClC,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,KAAK,GAAG,aAAa,CAAC,MAA6B,CAAC,CAAC;IAE3D,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5E,CAAC"}